19 ms·
Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom
- seviu 1y agoHats off to the hackers for getting through to Coinbase support
- deleted 1y ago[deleted]
- walamaking 1y agoUnderappreciated comment.
- mooreds 1y ago[flagged]
- mooreds 1y agoOops, I was wrong: From https://techcrunch.com/2025/05/15/coinbase-says-customers-personal-information-stolen-in-data-breach/ https://techcrunch.com/2025/05/15/coinbase-says-customers-pe... > The company said the hacker stole customer names, postal and email addresses, phone numbers, and the last four-digits of users’ Social Security numbers. The hacker also took masked bank account numbers and some banking identifiers, as well as customers’ government-issued identity documents, such as driver’s licenses and passports. The stolen data also includes account balance data and transaction histories.
- deleted 1y ago[deleted]
- throwawayfour 1y agoI wonder what percentage of Coinbase's (but also any other company storing PII data) support is done by AI at this point, and whether they could focus on and invest much more heavily to make that as close as possible to 100%.
- jqpabc123 1y ago[flagged]
- cft 1y agoDouble down on KYC /s
- OhMeadhbh 1y agoI mean... wasn't coinbase sort of scammy to begin with? Several years ago I gave them some USD, turned it into BTC, saw the value of the BTC go up, but when I tried to cash out was told that wasn't a thing that was supported by their platform. Later I was told I could apply for a $399/year credit card and could partially pay off the balance with BTC sale proceeds. I'm sure this was all disclosed somewhere in the terms of service I clicked through, and I only lost $1000 to their scheme. But I've always wondered why people think this is how investment vehicles work. I monkeyed around with stock market bets and even Robin Hood allows you to cash out of your positions.
- ceejayoz 1y agoCoinbase most certainly permits cashing out. Are you sure you didn't fall for a scam version?
- kordlessagain 1y agoIt's more likely you didn't "lose" $1k, but that you had "missed profits". And if you missed the profits because you didn't verify yourself earlier for withdrawal, then that's on you. Coinbase supported direct bank withdrawals well before they launched their crypto debit cards.
- ceejayoz 1y agoYour profits are your profits. Coinbase can hold them until you verify yourself for withdrawals, but they can't just take them.
- allears 1y agoI dunno why you had problems, but I've been using Coinbase with no problems at all for years. It's linked to my bank account, so if I want to pay for something with bitcoin, I can easily buy and send bitcoin with just a few clicks. I don't invest or speculate in bitcoin, so I only maintain a small account balance. And selling bitcoin and transferring the proceeds to my bank account has been just as easy and trouble-free.
- coolcase 1y ago
- forix 1y agoVideo response from Coinbase's CEO: https://x.com/brian_armstrong/status/1922967787309256807 https://x.com/brian_armstrong/status/1922967787309256807
- neilv 1y ago[flagged]
- Crosseye_Jack 1y agoI thought hackers always had the hood covering thier head!
- neilv 1y agoSo obviously he's not the bad guy here, since his hood is down. :) Yet he's a bit urban edgy here, and the staging is like it's an impromptu social media reaction to some online slight. (though reading a script) You don't want to go full South Park "We're sorry", but I'd feel better about a response in a business dress shirt, out of respect for wronged customers. With a bit more humbled posture. IMHO, you're answering to customers you've wronged, and you don't wear a hoodie to church nor court (nor do you play video games during a live TV interview), nor do you assert superiority over the people you let down. You can convey respect and humility, while also conveying being capable of responsibly resolving the problem. (Just one person's reaction. I see some things the video did right, IMHO, but some other things jump out as wondering why they did that.)
- deleted 1y ago[deleted]
- gnabgib 1y agoDiscussion forming (14 points, 8 comments) https://news.ycombinator.com/item?id=43994545 https://news.ycombinator.com/item?id=43994545
- whatamidoingyo 1y agoThe article says they sent an email, but I usually ignore emails from Coinbase. I hope there's going to be a better way to find out if your data was breached. I was locked out of my account before, and had to upload an ID. I thought they didn't store it... :o
- hypeatei 1y agoWhatever you think of Coinbase, this is a pretty good response IMO: > and will not pay the $20 million ransom demand we received. Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible
- ajma 1y agoThat's the same move from the Ransom movie from 1996 https://youtu.be/haThIxPnYro?si=Jxu0elA-ylB5Z15q https://youtu.be/haThIxPnYro?si=Jxu0elA-ylB5Z15q
- pcl 1y agoI’d say the better thing for customers would be to pay the ransom demand and get the PII back. If they want to fund a reward scheme too, well great, but if it were my data, I’d care more about Coinbase limiting the breach of the data, not playing around with retaliatory rewards.
- deburo 1y agoLimiting? The damage is already done.
- hypeatei 1y agoThere is no guarantee that an anonymous criminal is going to hold up their end of the agreement. Coinbase has no idea who they're negotiating with or where that data has been shared. That, and they're reimbursing customers who were tricked.
- int_19h 1y agoIn addition, paying the ransom would be an open invitation for everybody else to try the same attack, with the net result that all customers are less secure in the long run.
- twodave 1y agoI love it. This also would have been a great opportunity to break out of corporate speak for a moment for a good “Up yours hacker assholes!” Even us folks in the Bible Belt appreciate a well timed swear word here and there.
- neilv 1y agoThe article keeps saying overseas employees or contractors, but isn't more specific on who Coinbase entrusted with this sensitive customer PII. The bottom line is Coinbase didn't adequately secure sensitive customer information, and it was leaked. Not, "Gosh, 'overseas' people, what can ya do?"
- owlninja 1y ago[flagged]
- adrr 1y agoQuestion that needs to be answered if they were prosecuted. Losing your job but getting to keep the bribe just means it will still happen.
- kragen 1y agoIt's probably hard to keep call-center workers bribe-proof.
- orionsbelt 1y agoYes, but I do think an organization like Coinbase or a cell phone carrier - which are extreme targets of fraud - have an obligation to recognize that their employees are targets and implement greater security measures than most organizations. Maybe Coinbase should even pay higher wages and use onshore customer service agents.
- kragen 1y agoWell, it sounds like they do implement greater security measures than most organizations.
- CryptoBanker 1y agoDoesn't matter when Coinbase still got exploited
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- ty6853 1y ago[flagged]
- deleted 1y ago[deleted]
- blindriver 1y agoThere should be an ISO standard with respect to how much power and information that front line customer support agents have. The more information you need, like changing passwords or accessing personal information, should get forwarded to higher level customer support agents with better training and more monitoring. This way you can design customer support experience with as little exposure to security issues as possible.
- whyever 1y agoThey main defense against internal attacks is bookkeeping. Banks have been dealing with this for thousands of years. I recommend the corresponding chapter in Security Engineering by Ross Anderson: https://www.cl.cam.ac.uk/archive/rja14/Papers/SEv3-ch12.pdf https://www.cl.cam.ac.uk/archive/rja14/Papers/SEv3-ch12.pdf
- SoftTalker 1y agoBookkeeping will alert you to employees stealing your money. It won't alert you to employees selling information.
- whyever 1y agoAccess logs do help with this. They have been successfully used by the police to identify rogue officers abusing their access to police databases.
- wepple 1y ago> better training and more monitoring. That’s very load-bearing. It won’t help. The CS reps are based in a LCOL country so the opportunity for theft is simply incredibly lucrative. What is really needed, is customer-in-the-loop for access to their data. The problem is, not all accesses would make sense. Doing analytics over the data of the top 1% of customers, for example, requires some level of access, but would freak out those customers if they had to approve it.
- 1y ago
- deleted 1y ago[deleted]
- chmod775 1y agoSaved dimes on customer support, lost $400m. It's hard to not believe in Karma sometimes.
- deleted 1y ago[deleted]
- Crosseye_Jack 1y agoIt will happen (at least attempted) with on-shore support staff too, My next door neighbour used to work for a UK high street bank and even there support staff were approached, with some of them first befriended, and eventually bribed in to passing along PII. No doubt it happens in the US too. Just costs the bad guys more.
- esaym 1y agoKeeping things onshore means the offenders could face jail time. Anything offshore just goes into a blackhole.
- sam36 1y ago> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States yea that is what they get. Hope this hurts them bad. At my last job for a "casual dating" app, all new account verification stuff was sent to some shop in the Philippines. I got involved with troubleshooting some random DB locks that were causing down time. Ended up discovering that this firm tried to automate the verification process with some scripts or something that would sometimes go haywire and send over 100 requests per second to the new account admin portal which would bring down the entire site. Management just asked them nicely to be more careful which brought the peaks down to 80 requests per second which the back end seemed to be able to cope with (just barely). They couldn't careless that there were supposed to be humans looking at this data and they were clearly trying to automate that part out. Even worse, once I started looking at the data that was in the portal, it was credit card name and billing addresses, and DL license or passport scans. Before I could really further fix the performance issue, I was laid off. Then a few months later they did another lay off which cleaned out every american employee. This was an american company that had ~150 american employees and now there are none. Just two execs at the top that get to watch the money roll in while they farm out everything to overseas. Really pisses me off bad >:(
- mxhold 1y agoInteresting coincidence? >On April 12, Coinbase updated their user agreement to take effect TODAY, May 15, with new language about waiving some rights to class action lawsuits and jurisdiction selection. https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647cc2f https://bsky.app/profile/jsweetli.bsky.social/post/3lp7sw647...
- sitkack 1y agoThis should be illegal.
- jbverschoor 1y ago1 day after they were emailed. Also, "Coinbase had detected the breach independently in previous months", aren't they required to disclose this? In the EU they are: Every EU institution must do this within 72 hours of becoming aware of the breach, where feasible
- kmfrk 1y agoThe classic added arbitration clause after a massive breach. Happened with Sony and iirc Valve (through Steam) off the top of my head.
- deleted 1y ago[deleted]
- thepasswordis 1y agoThe problem is that it seems like the data that leaked is also the data that would be used to do account recovery. And what that means is that 1) If you lose access to your account (through either your own fault, or coinbases fault) that the process of recovering it may not be so straightforward anymore. 2) Hackers can try to “recover” accounts now using this leaked info. This is a huge problem. What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this) The only solution here is: hardware 2 factor like yubikeys.
- piva00 1y ago> What coinbase needs are IRL offices where you can go and do things like account recovery, and where people trying to steal money can be caught and prosecuted (and makes a huge barrier for the overseas thieves who are usually doing this) That's just a bank.
- thepasswordis 1y agoCorrect. Coinbase is a bank that holds cryptocurrency.
- DonHopkins 1y agoAnd OpenSea is a zoo that holds apes.
- dowager_dan99 1y agoBeyond the regulatory-dodge and crypto marketing explain to me how Coinbase is NOT a bank
- Analemma_ 1y agoCryptocurrency firms exist in a quantum superposition of bank and not-a-bank until you interact with them, at which point they collapse into whichever state costs them less money.
- sroussey 1y agoEmployees at Signal must be getting bribes as well, or even threats of violence since they can get nation state Secret communications these days. Got to make it so employees can’t do anything nefarious. This helps protect them.
- lawn 1y agoHow would employees of Signal access the encrypted messages?
- sitkack 1y agoEmployees can't get access to encrypted messages. But they can look the other way about flaws in their Electron client.
- sroussey 1y agoOr any client.
- NoMoreNicksLeft 1y agoRoll out an update that defeats the end to end encryption in some subtle way that wouldn't go noticed for a few days. They'd be told when to do it for maximum effect, and if the window is small enough it might even go unnoticed for far longer when another uncompromised update overwrites it. They have no duty to report such things to relevant authorities even if it was discovered internally, so you could be looking at some corporate coverup that while not in on it, seeks to minimize liability/embarrassment. Really, can you possibly tell if your Signal messages were compromised? Now that iPhones aren't really jailbreakable, you can't even see inside your own device.
- sroussey 1y agoThey don’t need to. Under specific conditions, the client can communicate with malware already on device, save data locally for other software to pick up, or downright stream the decrypted software to a third party. Most likely is to introduce a flaw in the client that can be used by other walware on the client. Clearly no red team members on HN these days.
- kragen 1y agoIt's really unfortunate that KYC regulations required Coinbase to have this information in the first place. We should be establishing strong social norms against sharing PII without a legitimate reason; this is not just an individual theft risk but a national security risk. Coinbase doesn't pay into your Social Security account, so they shouldn't have your Social Security number. They don't visit your house, so they shouldn't have your address. Etc. Historically, although KYC regulations were widespread in Communist countries, they were unthinkable in most democratic countries until 9/11, which provided spy agencies with their golden chance to write their wishlist into law. But unfortunately that helps foreign spy agencies just as much as, maybe more than, it helps domestic ones. In https://en.wikipedia.org/wiki/Know_your_customer#Laws_by_country https://en.wikipedia.org/wiki/Know_your_customer#Laws_by_cou... you can see when they were introduced in different countries.
- dowager_dan99 1y agoLet's hear you repeat this position after your Coinbase account is compromised and you're looking for recourse.
- kragen 1y agoYou seem to believe that AML/KYC regulation exists to benefit customers or to prevent or recover from account compromises. It does not, and I have no idea why you would think it does. Something like a Yubikey or iris-scanning stations could help to prevent Coinbase account compromises, but AML/KYC regulations do not require or even encourage them, though perhaps someday they will.
- westonplatter0 1y agoIt's ironic this came [out] the day after COIN is going to be added to the SP500.
- haakon 1y agoAnd also the same day as it was reported the SEC is investigating Coinbase over claims it overstated user numbers in past filings (https://www.thestreet.com/crypto/policy/sec-is-investigating-whether-coinbase-misstated-user-numbers-report https://www.thestreet.com/crypto/policy/sec-is-investigating...). It's been a bad day.
- paxys 1y ago[flagged]
- JumpCrisscross 1y ago> if you don't have sole control of your cryptocurrency keys then you don't own any cryptocurrency Nobody has sole control of their cryptocurrency by definition. It's a consensus protocol. (On a practical level, there are always layers of trust.)
- deleted 1y ago[deleted]
- ArtTimeInvestor 1y agoFrom the Coinbase website: https://www.coinbase.com/en-de/blog/protecting-our-customers-standing-up-to-extortionists https://www.coinbase.com/en-de/blog/protecting-our-customers... What they got - Name, address, phone, and email - Masked Social Security (last 4 digits only) - Masked bank‑account numbers and some bank account identifiers - Government‑ID images (e.g., driver’s license, passport) - Account data (balance snapshots and transaction history) Wow. Why does customer support staff have access to images of the user's passports?
- kragen 1y agoSpy agencies regulating financial institutions (really): https://news.ycombinator.com/item?id=43996848 https://news.ycombinator.com/item?id=43996848
- rtkwe 1y agoI also like 'last 4 digits only' as if that's not the most important parts and the part so many places use to validate your identity, the first 5 are just area and group so they're not exactly random.
- Ozarkian 1y agoEveryone's social security number is available. If you go download the leak referring to in this HN post [1], your SSN is certainly in it. Mine was, everyone in my family's was, almost all of my friends' were. The world needs to stop pretending that SSNs are secret. They aren't. [1] https://news.ycombinator.com/item?id=41248104 https://news.ycombinator.com/item?id=41248104
- Kiro 1y agoThe world has stopped pretending a long time ago. In my country SSN is public information.
- anton-c 1y agoDoes it require the skills of using powershell to open and search? I'm very curious but am not a coder, I do audio and graphic design. That being said I've copy pasted pieces of python, tailored it to my use and made it work.* I'm just very curious to check for myself and my family. *hah, here's me making it work https://www.youtube.com/watch?v=PMeRFnkHgBc&t=97s https://www.youtube.com/watch?v=PMeRFnkHgBc&t=97s
- pentagrama 1y agoMaybe it’s a naive question, but in many breach reports I see things like 'No passwords, private keys, or funds were exposed.' How come companies can usually protect that kind of data, but not emails, names, and other personal info?
- dboreham 1y agoIt was some BI/analyst database that leaked?
- selectout 1y agoCompanies want the ability to use things like emails, names, and other data for user experiences (go to settings, see name and change it), advertising (target this address book for X ad), etc. So these are typically plaintext (oversimplified) and accessible by different systems while passwords or private keys have one use case only and can have a higher bar of protection.
- wat10000 1y agoA properly implemented login system will never store a password in the first place. Properly hashed passwords can still be cracked in some cases, but if your password is strong and the hash is good, it’s safe.
- LorenPechtel 1y agoSuch data is typically encrypted and purely write-only, only read by the system itself. Thus it is only exposed if the database itself is exposed. If the leak was compromise of the systems that access the data (which appears to be the case here--insiders copied data they could access) the write-only info is not exposed.
- daveguy 1y ago... and once the crypto is transferred. Poof, you're ducked.
- daveguy 1y ago... literally ducked. Crypto is a beautiful platform for money laundering. Why do you think Trump loves it so much?
- molticrystal 1y agoAnd the reason Coinbase has to keep all that sensitive stuff, much more than what would be required to identify and authenticate you, which you hope will never be stolen, is because of know your customer laws, so you can thank your government that pictures of your passport got stolen and for whatever criminals and rogue Coinbase employees do with that info.
- ryuhhnn 1y agoThere are very good reasons for KYC, the problem here is not the government regulation, it's once again private companies being sloppy with their customer's data because sloppy is cheap and it's not their info on the line, it's yours, so there's little motivation for them to safeguard it _unless_ they're compelled to do it by law.
- J0nL 1y agoThey're not just another free-to-use site where you're the product. Their reputation and viability are on the line. For a site such as this the odds aren't in their favor anymore.
- goobie 1y agoThe people who designed a government regulation to deputize private companies couldn't possibly have known how sloppy private companies are with other people's data? They could have designed KYC to minimize long-term storage requirements etc at some cost to what they could enforce, but a government like the US is inherently sloppy with the rights that are reserved for parties besides itself.
- refulgentis 1y agoI think if I coloured it as [gov't] deputizing [companies], and prioritized financial banks not knowing their customers, in case they decide they get hacked, I could sort of get excited about blaming regulation. At the end of the day it'd be hard for me to continue holding that because, on the balance, we expect companies to keep data private and to not enable illegal activity, not gov't to avoid asking companies to do things, lest they screw up.
- elif 1y agoSo this is probably why the phishing calls have increased from ~1 per month to ~3 per week.. good to know... Wish coinbase would let me DO something about it... Maybe fresh accounts for everyone? Maybe KYC data not directly linked to accounts? There should be SOMETHING they can do because the sheer volume of people constantly harassing CB customers is nuts.
- xyst 1y agoForget relying on brokerages like COIN. If you care about the security of your digital assets, use a cold wallet or non-custodial account.
- ycombinatrix 1y agoThe comment you're replying to was complaining about scam calls, not about wallet security. Using a hardware/"cold-ish" wallet does not protect you from scam calls: https://www.bleepingcomputer.com/news/security/physical-addresses-of-270k-ledger-owners-leaked-on-hacker-forum/ https://www.bleepingcomputer.com/news/security/physical-addr...
- AznHisoka 1y agoWhen i get those calls, i usually tell them “why dont i just save everyones time and just give you my bank account number, password and social security number? That sound good?”
- lavezzi 1y ago> So this is probably why the phishing calls have increased from ~1 per month to ~3 per week. Yes and their timeline doesn't add up with what they disclosed. If you take the Coinbase narrative, they only believed this was a 'material' issue once contacted by the hackers for a $20m demand, they weren't able to put the pieces together themselves. The phishing has been elevated for weeks, especially via text message, and their lack of internal controls for access and monitoring are clearly severely lacking.
- deleted 1y ago[deleted]
- skybrian 1y agoBlog post is here: https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists https://www.coinbase.com/blog/protecting-our-customers-stand... > We will reimburse customers who were tricked into sending funds to the attacker due to social engineering attacks. If your data was accessed, you have already received an email from no-reply@info.coinbase.com; all notifications went out at 7:20 a.m. ET on 5/15 to affected customers.
- gkoberger 1y agoThe no-reply is an interesting decision. I get how difficult it is to run a company like Coinbase (their biggest strength, centralized + customer support, is also what enables this social engineering), but feels like an odd choice.
- sh34r 1y agoTheir "customer support" includes not expecting users to set up PGP to communicate with them. Email is not a secure method of communication by default. It's fine to send a notification instructing them to visit the secure portal for more info, though. Hence, no-reply.
- gkoberger 1y agoYeah, I totally understand it!
- scotty79 1y agono-reply is a good practice. No business should ever encourage their customers to reply to the emails they are sending out. That's what scammers do. To contact the company you should go to company website at the address you know (which shouldn't be given in email as well), log in and send a message through internal message system, possibly referring to the email that you recieved through a random code (those can be auto-suggested if they recently tried to contact you by email). If you do anything else your communication knwowingly mimics communication of a scammer. Unrequested email should always only be one way communication. Email is too untrustworthy for it to be anything more.
- DonHopkins 1y ago>We will reimburse customers who were tricked into sending funds to the attacker. How many people are going to anonymously attack themselves now, just to get a reimbursement!
- sgarman 1y agoI tried to reach out to coinbase customer support to see if I was impacted. Once I wasted my time with the AI bot and got a human they were unaware of the breach. I was the first person to inform them about it.
- modeless 1y agoThey emailed impacted accounts. Source: I was impacted
- w-ll 1y agoWas this the general "Important Notice" email that went out this morning, or something more specific.
- modeless 1y agoThe "Important Notice" I got says "This included information related to your account". Also I got an email earlier on April 1 about a breach that sounds very similar if it's not the same one.
- w-ll 1y agoSorry to pester, that exact wording? I see "We wanted to let you know that we detected activity suggesting that information related to your account may have been accessed in a way that did not align with our internal policies." in the email i got this morning
- 1y ago
- growlNark 1y agoI'm surprised they only demanded $20M. Surely that customer data is potentially worth, like, potentially orders-of-magnitude more. Correspondingly I'd assume either a) paying the ransom doesn't take it off the market or b) the info they stole isn't that interesting.
- drexlspivey 1y agoThey only stole 80000 emails (1% of their monthly active users) not the whole userlist
- mgillett54 1y ago> less than 1% of Coinbase monthly transacting users Unclear if users whose data was stolen, but did NOT transact in the last month are included in this statistic. Feels like a very intentional phrasing on their part https://www.coinbase.com/en-gb/blog/protecting-our-customers-standing-up-to-extortionists https://www.coinbase.com/en-gb/blog/protecting-our-customers...
- AznHisoka 1y agoI’ve been getting scam texts from scammers who claimed my Coinbase account was compromised and to contact them. I wonder if this incident was the root cause
- couchdive 1y agowait, coinbase has staff?
- modeless 1y agoI have been receiving regular spear phishing calls from these guys, or someone who bought the leaked data, with classic tactics like claiming that I need to confirm a potentially fraudulent transaction. They speak perfect English with an American accent, sound very friendly, and have knowledge of your account balance. Thankfully on the first call I realized it was a scam right away, and Google's call screening feature takes good care of the rest. Wish I could forward them to Kitboga[1]. I guess they didn't have as much luck as they wanted scamming Coinbase's customers, and once they had their fun they decided to try extorting Coinbase themselves. [1] https://www.youtube.com/watch?v=HNziOoXDBeg https://www.youtube.com/watch?v=HNziOoXDBeg
- VectorLock 1y agoI just switched to iPhone from a pixel device and I’m shook by all the spam calls. How do iPhone users deal with this?
- Theresa1414 1y ago[flagged]
- rdtsc 1y ago> recruited a group of rogue overseas support agents Why not just say what country the are from and how they hired them to start with. It's presented as those sneaky "overseas" people that somehow got access to our systems. This company makes what, a few billions in revenue but they couldn't vet and hire the right people?
- ChrisMarshallNY 1y ago> Instead we are establishing a $20 million reward fund for information leading to the arrest and conviction of the criminals responsible for this attack. I’m not usually a huge fan of crypto folks, but I applaud this. I hope they are serious about paying the reward, and aren’t planning to rug-pull it.
- reaperducer 1y agoI hope they are serious about paying the reward, and aren’t planning to rug-pull it. They could always pay it in crypto.
- ChrisMarshallNY 1y agoIt might not be a bad idea for the various crypto exchanges to pool their resources into a non-denominational security organization. It could offer hardening services, and some kind of accreditation. It would also make many Ponzi schemes easier to spot, as they wouldn’t want to contribute.
- sumeno 1y agoThey make money selling the ponzi schemes, they don't want to make them easier to spot
- akshaybhalotia 1y ago[flagged]
- J0nL 1y agoI'm having de ja vu here. If they only found out when they attempted to extort them does it mean they don't even bother to log employee access? Is there any means for accountability at all internally? It would be so simple to have access tracking and flag or lock out rogue employees... I look forward to seeing what the golden parachutes look like.
- lxgr 1y agoLogging and retroactive auditing seems like the very least they should do. Even asking the customer service agent to first provide identifying details of the customer they can't easily know or guess by themselves doesn't seem excessive, given the sensitivity of the information. It won't work for 100% of all calls (what if the customer is locked out themselves etc.), but those calls can then be handled by even more closely monitored agents. "Less than 1% of monthly transacting customers" means up to 1% were accessed – that seems very high, i.e. much higher than the number of customer service contacts I'd expect.
- fckgw 1y agoLooking at their blog post, it seems like they paid customer support agents to hand over sensitive data. The attackers did not have access to any agent accounts themselves, and the customer service agents were accessing data they were already privileged to anyways. https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists https://www.coinbase.com/blog/protecting-our-customers-stand...
- throitallaway 1y agoIt makes me wonder what type of access support agents have in the first place. A lot of this information should require "unlocking" on a case-by-case basis by challenge/response while interacting with a customer.
- lavezzi 1y agoThe customer service agents were accessing data they were already privileged to anyways. That's not how front line support agent access should work. You get access based on active cases you are working on, not the keys to the kingdom because you might need to support a member at some future point in time.
- rkagerer 1y agoCoinbase seems to be going to great lengths to try and distance themselves from the so-called "rogue overseas support agents". If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom. Reimbursing duped customers makes sense, as it seems like they would have a pretty straightforward case to make in court that Coinbase's actions led to their loss. I'm more curious if someone who feels the need to move, change banks, change their email, hire a security detail etc. could successfully sue the company to recover some or all of those costs.
- vonneumannstan 1y ago>If they were Coinbase employees or contractors, that means the company basically sold its own data to hackers, who then turned around and demanded a ransom. This seems like a strange interpretation. If an employee at your company, against policy and likely illegally extracts proprietary data and gives it to hackers in exchange for money you can hardly say that "My company sold it's data".
- behringer 1y agoIn a way you can. A company is its employees. If you want employees with integrity you might need to pay better than bottom dollar employees from the cheapest countries possible. I once applied for a bank position, and they wanted to run a credit check. If you're in a position of handling money, the company has a responsibility to vet its employees. Do I agree with credit checks? Absolutely not, but the point is, Coinbase is partially responsible and that's why they're refunding duped customers. How far that responsibility goes is up for debate.
- rkagerer 1y agoI agree it wasn't authorized, but I should absolutely still be able to hold the company responsible for the damage. My business relationship is with you, not your employees or vendors. They in turn could go after the perpetrator. If they're using contractors who are cheap, unvetted, untrustworthy or don't carry liability insurance that's their problem and shouldn't excuse them of accountability.
- ipv6ipv4 1y agoOne more reason to ignore Coinbase’s weekly harassment email to update my information.
- babyshake 1y agoA few weeks ago I got this email: Update to the Coinbase User Agreement We are emailing you about an important upcoming update to the Coinbase User Agreement. This update will revise our Arbitration Agreement with you. We made these updates to streamline the process for resolving disputes. You can read the entire agreement here. The revised terms are in sections 9.9, 9.10 and Appendix 6. These terms apply only to disputes that you or we initiate after May 15, 2025. The current terms will continue to apply until May 15. --- What date did this news come out? I see it just happens to be the same date as mentioned in this email, May 15. Coinbase sneakily is trying to prevent their customers from exercising their legal rights. If you work for Coinbase, you ought to be ashamed and quit. If you use Coinbase, remove all your assets immediately. I'm open to hearing reasons why this is just a coincidence or I'm misinterpreting the situation. Please, go ahead.
- deleted 1y ago[deleted]
- sarki01 1y ago[dead]
- sarki01 1y ago[dead]
- aussieguy1234 1y agoGiven how little customer support agents in cheaper countries are paid, i'm surprised this type of serious attack has not happened sooner. Corruption in these countries is extremely common. We're used to having a government that actually works in western countries. In these cheaper countries, bribes are routine and almost unavoidable. Given the culture of corruption and how little the support agents are paid, it was only a matter of time before some bad actor tried to bribe them. Medical bills are expensive and need to be paid, making the agents highly vulnerable to this type of attack. For many, the choice would be to accept the bribe, or let their sick child suffer from a treatable condition. Now that a high profile attack has happened, expect copycat attacks from other bad actors.
- silisili 1y ago> the Company has preliminarily estimated expenses to be within the range of approximately $180 million to $400 million relating to remediation costs Hopefully companies take this as a lesson about bottom dollar outsourcing your CS. For those amounts, they could afford to have hired regionally local support agents, and paid them well over industry standard...
- rschiavone 1y agoHA! Good one. They won't.
- soco 1y agoThe global trend is racing to the bottom, so even if they could, every business consultant or MBA would push them to rather put more AI agents instead. Because that's all what matters (to them). Did anybody learn anything out of this? Of course not.
- thephyber 1y agoBut do they consider it a CS risk or a business-wide risk? Is there any role at CoinBase that isn’t susceptible to insider risk? I would argue they would treat it as a security department / business risk issue and not a CS-only issue. Onshoring CS and paying some more for that role may result in a net change of 0 risk (eg. The same possibility of a breach over the same time interval). Would a lower class (for that region) Alabama man have less the susceptibility to insider risk as a middle class (for that region) Philippino man? Most likely, the company will focus on better segmentation and better adherence to least permissions for all roles. Also, your logic is clouded by the fact that you know it happened. In all aspects of security/cybersecurity, risk is incredibly difficult to calculate because you have to accurately know how much a counterfactual would cost in order to accurately choose one option over the other.
- esaym 1y ago>Would a lower class (for that region) Alabama man have less the susceptibility to insider risk as a middle class (for that region) Philippino man? The american could be facing jail time, depending on the data. The Philippino man, not so much.
- Flex247A 1y agoJust when it was included in S&P500 :(
- coinbased2 1y ago[dead]
- mafriese 1y ago> The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities Based on the information present in the breach, I think it's likely that the source was their customer support in the Philippines. Monthly salary is usually < 1000$/month (entry-level probably even less than 500$) and a 5000$ bribe could be more than a year worth of money, tax-free. Considering the money you can make with that dataset now, this is just a small investment. > •Name, address, phone, and email; •Masked Social Security (last 4 digits only); •Masked bank-account numbers and some bank account identifiers; •Government‑ID images (e.g., driver’s license, passport); •Account data (balance snapshots and transaction history); and •Limited corporate data (including documents, training material, and communications available to support agents). This is every threat actor's dream. Even if you only had email addresses and account balances, this is a nightmare. Instead of blackmailing the company, you can now blackmail each individual user. "Send me 50% of your BTC and I won't publish all of your information on the internet". My guess is that we will have a similar situation like we had with the Vastaamo data breach... https://en.wikipedia.org/wiki/Vastaamo_data_breach https://en.wikipedia.org/wiki/Vastaamo_data_breach
- lm28469 1y ago> •Name, address, phone, and email;\ > blackmail each individual user Blackmail would be the least of my worries, in France we had at least five kidnappings/attempted kidnappings related to crypto investors since the beginning of the year.
- bambax 1y agoYes that's true but it's weird they only focus on crypto investors' families? There are many rich people in France, what's the deal with cryptobros?
- paranoidrobot 1y agoBecause it's easier to move crypto than physical cash.
- asim 1y agoAssuming they will have to inform the individuals who's data was actually breached/taken? Or is this basically the entire customer base? In which case that is VERY bad.
- skybrian 1y agoTheir blog post says they notified affected users yesterday: https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists https://www.coinbase.com/blog/protecting-our-customers-stand...
- asim 1y agoFrom the sounds of it, this is limited to US customers? Just going by the mention of social security number which does not exist in other countries like the UK.
- Tycho 1y agoA few days ago I missed a delivery from UPS (in the UK). The next day I got a text from an unrecognised cell phone that just said “Hello” and didn’t respond further. The day after that I got a scam call (another UK cell number) from someone trying to hack into my Amazon account. They wanted me to supply the OTP code that Amazon texts you for 2FA. Anyway I eventually tracked down my package (it was at a convenience store awaiting pick up), and lo and behold they had printed my phone number along with name/address on the package. I suspect someone harvested that and passed it to the scammers (not necessarily a UPS employee, could be the drop off locations they contract with). I suppose I’ll report it to the police in the slim hope that it will help them catch the scammers.
- flakeoil 1y agoNot sure how you relate your UPS delivery with the scam call? Just because it happened the following day you expected a delivery? I could be just a coincidence. I'm sure scammer's got get your phone number from many other sources and data breaches.
- Tycho 1y agoIt could have been a coincidence, but I don’t receive deliveries often, and I don’t get scam calls often, so the timing and circumstances make it highly suspicious.
- olalonde 1y agoBrian Armstrong (Coinbase CEO) posted a video about this today: https://x.com/brian_armstrong/status/1922967787309256807 https://x.com/brian_armstrong/status/1922967787309256807
- koakuma-chan 1y ago"But customer support agents do have access to personal information like name, date of birth, address, et cetera" Apparently "et cetera" includes photos of my ID? Why do they even keep it?
- cmcaleer 1y agoThe more alarming part for me is that, given the scale of the breach, there was clearly some way for this CS access to (a) query and download data from a database and (b) exfil that data in bulk. Where on earth were the controls?
- olalonde 1y agoThey are required to by law (thanks to AML regulations).
- I_am_tiberius 1y agoWhy did those employees have access to such sensitive data? We could argue about the legal requirement to submit this data in general, but I really don't understand why (most of) this data isn't stored in an encrypted way and only accessible by a few people in the company.
- tomhow 1y agoDirect link to SEC filing: https://www.sec.gov/ix?doc=/Archives/edgar/data/0001679788/000167978825000094/coin-20250514.htm https://www.sec.gov/ix?doc=/Archives/edgar/data/0001679788/0...
- ahoog42 1y agoIf you want to be alerted to new/updated SEC cybersecurity filings, you can subscribe to my free alerts [1] or see the full index of cybersecurity incidents [2] on my tracker (I check SEC EDGAR every 5 mins). [1] https://www.board-cybersecurity.com/alerts/ https://www.board-cybersecurity.com/alerts/ [2] https://www.board-cybersecurity.com/incidents/tracker/ https://www.board-cybersecurity.com/incidents/tracker/
- shireboy 1y agoAs bad and annoying as this is, I do think “we won’t pay the ransom but set up a reward fund in the same amount to find the perps” is an interesting approach. It turns the tables such that any of the criminals or associates now are incentivized to turn on each other. I could see ways it wouldn’t work (they lie to get the reward, future scammers set up the scam with a patsy so they can collect reward), and am not sure it plays the same if there is actual exposed keys, etc.
- I_am_tiberius 1y ago"et cetera"
- revicon 1y agoThey've been constantly bugging me to upload my government ID, never did. Now I'm really glad I didn't.
- tre7 1y ago[dead]
- micahsebastian8 1y ago[dead]
- Slava_Propanei 1y ago[dead]
- rlnvlc 1y agoGreat timing: https://www.citationneeded.news/issue-84/ https://www.citationneeded.news/issue-84/
- ryanjonney 1y ago[dead]